IdP Login
Table of Contents
IdP Login
Configure the Identity Provider Login control to manage SAML-based SSO login access
through enterprise identity providers on the Prisma Browser.
Set the Identity Provider Login Control
| Prisma Browser Desktop | Prisma Browser Extension | Prisma Browser for Mobile |
|---|---|---|
| Full support | Full support | Not available |
The Identity Provider Login control allows administrators to govern
SAML-based SSO authentication through enterprise identity providers. When a user
attempts to authenticate through an identity provider such as Okta, Entra ID,
Ping Identity, or Google Workspace, the Prisma Browser intercepts the SAML
response and enforces the configured policy.
This control supports four enforcement modes, enabling administrators to allow or
block login through all identity providers, or target specific providers by
domain. The control is configured within the Access & Data policy rule
wizard under .
To set the Identity Provider Login control:
- From Strata Cloud Manager, select .Select a rule and navigate to .Select one of the following options:
- Allow - The Prisma Browser allows login with any corporate identity provider.
- Block - The Prisma Browser blocks login with all corporate identity providers.
- Allow specific Identity providers - Only login with the specified identity providers is allowed. Login with all other identity providers is blocked.
- Block specific Identity providers - Login with the specified identity providers is blocked. Login with all other identity providers is allowed.
(Allow Specific / Block Specific only) Specify the identity provider domains to allow or block.Enter the domain of the identity provider (for example, login.microsoftonline.com or company.okta.com). Each domain must be a valid domain name.![]()
(Optional) Set prompt behavior. Select one of the following options:- None - No prompt is displayed. The login is blocked without user recourse.
- Warn and allow to proceed anyway - Inform the user about the restriction and allow the user to continue.
- Warn and allow to proceed anyway with a reason - Inform the user about the restriction. The user must provide a reason to continue.
- Permission request - Allow the user to send a permission request to the administrator. Once approved or denied, the user is notified.
When a prompt option is selected, configure the bypass timeframe. Select how long the bypass remains active after the user proceeds or receives approval.The Prompt option is not available when the effect is set to "Allow".(Optional) Customize dialog text. Configure the message displayed when the user is blocked:- Title (required if customizing) - The heading shown on the block page.
- Description (optional) - Additional context for the user.
- External link (optional) - A URL and label pointing to relevant documentation or resources.
If no custom dialog text is configured, the default message is displayed:- Title: "You are not allowed to log in"
- Description: "Logging into this site is prohibited to prevent sensitive data from leaving the organization."
Click Set.End User Experience
When the Prisma Browser blocks an IdP login, the user sees a full block page with the following information:- The configured title and description (or defaults)
- A Go back button to return to the previous page
- If a bypass option is configured: a Proceed anyway button to request bypass or proceed with reason
After bypass approval, the page displays "You can login now" with instructions to close the page and retry the login.When a user is blocked and uses the "Proceed anyway" prompt, the user cannot continue the flow immediately. The user must close the page and restart the login flow.Events
The Prisma Browser generates events when the Identity Provider Login control is enforced:Event Trigger Key Fields Login Attempt (Blocked) A SAML login attempt matches a blocking policy Rule ID, URL, login method (SAML), identity provider URL, service provider URL, policy action Login Attempt (Bypassed) A user bypasses a blocked login via prompt Rule ID, URL, login method, bypass reason Login Success A SAML login completes successfully (allowed) Rule ID, URL, identity provider URL, service provider URL, login user Login Fail A SAML login attempt fails authentication Rule ID, URL, identity provider URL, service provider URL, login user Limitations
- Mobile platform is not supported.
- Step-up MFA is not supported for the Identity Provider Login control.
- When a user is blocked and uses the "Proceed anyway" prompt, the user cannot continue the flow immediately. The user must close the page and restart the login flow.
- Only SAML-based identity provider logins are controlled. OIDC-based enterprise logins are not intercepted by this control.
